Stronger defenses against AI distillation attacks have cut the data harvested from Claude by about 90% to 99%, early evidence suggests. The measures target covert attempts to copy the model’s capabilities—and have cost its developer revenue and trillions of tokens’ worth of paying traffic.
Key takeaways
Claude’s reasoning-token extraction fell tenfold to a hundredfold after classifier deployment.
The detection system reports fewer than 0.1% false positives.
Repeated extraction attempts trigger tighter limits and account bans.
The company urges cloud platforms and model developers to disrupt abuse together.
Anthropic said in an October 12, 2026, blog post that its defenses combine restrictions on reasoning transcripts, extraction detection and account enforcement. Its safeguards have banned tens of thousands of accounts linked to distillation, often within two hours of a campaign starting.
Measuring defenses against AI distillation attacks
Distillation attacks are unauthorized, covert campaigns that extract one model’s capabilities to reproduce them in another. The company says attackers generate millions of responses, often through fraudulent accounts, to mimic advanced models at a fraction of their development cost and time.
The defenses focus on reasoning transcripts: the thinking Claude writes before answering. According to the company, these teach a smaller model more than final answers alone. After classifier deployment, the volume of reasoning tokens extracted on its platform stayed 10 to 100 times lower than before.
Earlier tests showed why protecting those transcripts mattered. A pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified; training on summarized transcripts produced 71.8%.
Attackers then shifted from collecting ordinary responses to actively extracting hidden reasoning. One laboratory tested 12,000 different requests. Proxy networks controlled hundreds of thousands of fraudulent accounts, used false identities and stolen payment details, and resold access where Claude was unavailable. A network described in the company’s February report managed more than 20,000 accounts simultaneously.
How the anti-distillation safeguards work
The company’s defenses against AI distillation attacks now restrict where reasoning can travel, block extraction requests and penalize persistent attempts. These measures address techniques that moved protected reasoning between conversations, models and accounts.
Preserved thinking, introduced with Claude Fable 5.1 and Claude Opus 5.5, prevents API accounts created on or after August 31, 2026, from editing Claude’s previous context. Those models’ reasoning also cannot be read by older models with weaker protections. Claude Sonnet 5.5 limits transcript access to the organization that generated it.
A two-stage classifier, tested through internal and external red-teaming, detects extraction requests with a reported false-positive rate below 0.1%. The system operates using Claude Sonnet 5.5, Claude Opus 5 and 5.5, along with Claude Fable 5 and 5.1. The company says it catches every distillation technique described in its September report.
Updates have blocked tactics involving translation of earlier reasoning or reproduction inside tags. Persistent extraction brings stricter usage limits and account bans. Since September 24, 2026, the company has also charged for requests blocked before Claude responds in categories, including distillation, where false positives stay below 0.1%.
Security concerns extend beyond Claude
The company argues that illicit distillation creates national security concerns when copied capabilities enter foreign military, intelligence and surveillance systems. It also says models developed this way can lack safeguards proportionate to their capabilities.
It cites Zhipu’s development of GLM-5.3. According to the blog, Zhipu tried extracting cyber capabilities from Claude Fable 5, then switched to an older Claude model and another laboratory’s model after safeguards impeded its attempts.
According to Anthropic, the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) — referred to by NIST as CAISI — determined that GLM-5.3 is the most cyber-capable open-weights model released so far. The company’s own research found easily bypassed safeguards and a willingness to develop complete security exploits.
The blog also describes requests to Moonshot’s Kimi models being secretly routed to Claude during distillation efforts, including a request to analyze CCTV footage of an individual.
The company calls for cooperation across frontier-model developers, cloud platforms and inference providers, where distillers distribute traffic. It says platforms can slow extraction by detecting abuse and removing fraudulent accounts. Some safeguards have also required legitimate users to update their integrations.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.